{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
        "slug": "constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent",
        "url": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/"
        },
        "title": "Constrain Borg serve to exact repository paths when that is the intent",
        "summary": "Test the exact repository boundary granted to a Borg server client.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:06+00:00",
        "modified_at": "2026-10-15T13:36:16+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 245,
        "potentially_affected": "This applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.",
        "dse_recommendation": "DSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction.",
        "primary_source": {
            "name": "Borg 1.4.5 — borg serve",
            "url": "https://borgbackup.readthedocs.io/en/stable/usage/serve.html",
            "published_on": null,
            "authority": "borgbackup.readthedocs.io"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Test the exact repository boundary granted to a Borg server client.</p>\n<h2>Source facts</h2>\n<p>Borg 1.4.5 serve distinguishes restrict-to-path from restrict-to-repository. A permitted path also allows its subdirectories, whereas a permitted repository grants access only to that repository and does not implicitly include descendants. Both can be specified more than once. The append-only option governs low-level repository segment appending; it does not prohibit reading or issuing archive delete and prune operations. Repository selection and low-level append behavior are therefore different controls with different boundaries.</p>\n<p>Source: <a href=\"https://borgbackup.readthedocs.io/en/stable/usage/serve.html\">Borg 1.4.5 — borg serve</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction. Prefer an exact repository boundary when sibling or descendant repositories should remain separate. Review low-level append behavior independently of the archive operations visible to the client, and keep repository maintenance authority separate from ordinary backup access. Record how the server process receives its restrictions so a future account or service change does not silently broaden the permitted storage tree.</p>\n<h2>Verification</h2>\n<p>With disposable repositories, test the intended permitted target, a sibling repository, and a nested repository. Confirm the server enforces the selected boundary. Rehearse append-only behavior separately and record what clients can still read or logically remove, without describing that test as proof against every privileged administrator action.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://borgbackup.readthedocs.io/en/stable/usage/serve.html\">Borg 1.4.5 — borg serve</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Test the exact repository boundary granted to a Borg server client.\nSource facts\nBorg 1.4.5 serve distinguishes restrict-to-path from restrict-to-repository. A permitted path also allows its subdirectories, whereas a permitted repository grants access only to that repository and does not implicitly include descendants. Both can be specified more than once. The append-only option governs low-level repository segment appending; it does not prohibit reading or issuing archive delete and prune operations. Repository selection and low-level append behavior are therefore different controls with different boundaries.\nSource: Borg 1.4.5 — borg serve.\nApplicability\nThis applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.\nDSE recommendation\nDSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction. Prefer an exact repository boundary when sibling or descendant repositories should remain separate. Review low-level append behavior independently of the archive operations visible to the client, and keep repository maintenance authority separate from ordinary backup access. Record how the server process receives its restrictions so a future account or service change does not silently broaden the permitted storage tree.\nVerification\nWith disposable repositories, test the intended permitted target, a sibling repository, and a nested repository. Confirm the server enforces the selected boundary. Rehearse append-only behavior separately and record what clients can still read or logically remove, without describing that test as proof against every privileged administrator action.\nOfficial reference\nBorg 1.4.5 — borg serve. Reviewed October 15, 2026.",
        "content_markdown": "Test the exact repository boundary granted to a Borg server client.\n\n## Source facts\n\nBorg 1.4.5 serve distinguishes restrict-to-path from restrict-to-repository. A permitted path also allows its subdirectories, whereas a permitted repository grants access only to that repository and does not implicitly include descendants. Both can be specified more than once. The append-only option governs low-level repository segment appending; it does not prohibit reading or issuing archive delete and prune operations. Repository selection and low-level append behavior are therefore different controls with different boundaries.\n\nSource: [Borg 1.4.5 — borg serve](https://borgbackup.readthedocs.io/en/stable/usage/serve.html).\n\n## Applicability\n\nThis applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.\n\n## DSE recommendation\n\nDSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction. Prefer an exact repository boundary when sibling or descendant repositories should remain separate. Review low-level append behavior independently of the archive operations visible to the client, and keep repository maintenance authority separate from ordinary backup access. Record how the server process receives its restrictions so a future account or service change does not silently broaden the permitted storage tree.\n\n## Verification\n\nWith disposable repositories, test the intended permitted target, a sibling repository, and a nested repository. Confirm the server enforces the selected boundary. Rehearse append-only behavior separately and record what clients can still read or logically remove, without describing that test as proof against every privileged administrator action.\n\n## Official reference\n\n[Borg 1.4.5 — borg serve](https://borgbackup.readthedocs.io/en/stable/usage/serve.html). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
                "url": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Constrain Borg serve to exact repository paths when that is the intent",
                        "item": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/#article",
                "identifier": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
                "url": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/",
                "headline": "Constrain Borg serve to exact repository paths when that is the intent",
                "description": "Test the exact repository boundary granted to a Borg server client.",
                "abstract": "Test the exact repository boundary granted to a Borg server client.",
                "articleBody": "Test the exact repository boundary granted to a Borg server client.\nSource facts\nBorg 1.4.5 serve distinguishes restrict-to-path from restrict-to-repository. A permitted path also allows its subdirectories, whereas a permitted repository grants access only to that repository and does not implicitly include descendants. Both can be specified more than once. The append-only option governs low-level repository segment appending; it does not prohibit reading or issuing archive delete and prune operations. Repository selection and low-level append behavior are therefore different controls with different boundaries.\nSource: Borg 1.4.5 — borg serve.\nApplicability\nThis applies to Borg 1.4.5 server-process restrictions, including supervised SSH forced-command deployments. It does not establish a complete SSH account policy or certify immutable recovery storage.\nDSE recommendation\nDSE recommends writing the exact set of repositories a backup client should reach before selecting a restriction. Prefer an exact repository boundary when sibling or descendant repositories should remain separate. Review low-level append behavior independently of the archive operations visible to the client, and keep repository maintenance authority separate from ordinary backup access. Record how the server process receives its restrictions so a future account or service change does not silently broaden the permitted storage tree.\nVerification\nWith disposable repositories, test the intended permitted target, a sibling repository, and a nested repository. Confirm the server enforces the selected boundary. Rehearse append-only behavior separately and record what clients can still read or logically remove, without describing that test as proof against every privileged administrator action.\nOfficial reference\nBorg 1.4.5 — borg serve. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:06+00:00",
                "dateModified": "2026-10-15T13:36:16+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/constrain-borg-serve-to-exact-repository-paths-when-that-is-the-intent/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Constrain Borg serve to exact repository paths when that is the intent"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 245,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Borg 1.4.5 — borg serve",
                    "url": "https://borgbackup.readthedocs.io/en/stable/usage/serve.html"
                }
            }
        ]
    }
}